Privacy Policy

What we collect

Your account. Your email address, your name, and a password stored only as a bcrypt hash — we never store your password itself. Alongside it we keep small preferences: your timezone, your theme and colour scheme, and your avatar colour. If you upload a profile photo, that image is stored in our database.

Your work. Everything you create in the app: tasks, workspaces, clients, labels, checklists, notes, reminders, calendar events, and the activity history the app generates automatically as you work.

Feedback you send us. When you submit feedback through the app we store its type, title, and description, along with your account.

Technical information. Your IP address is read from each request to enforce rate limits on sensitive endpoints such as login and password reset. It is held briefly in server memory and never written to our database.

What we do not collect

We use no analytics, no tracking pixels, no advertising, and no third-party scripts of any kind. There is nothing on any FocusMemo page reporting your behaviour to anyone. We do not sell, rent, or share your personal data, and we do not use your content to train AI models. FocusMemo performs no AI processing of your data today; if that ever changes, this policy will change first.

Your files stay in your own cloud storage

FocusMemo does not store your files. When you attach a file to a task, it is uploaded to your own connected Google Drive, Dropbox, or OneDrive account, and we keep only a reference to it — the filename, its type, its size, and the provider’s own file id.

To be precise about how that works: files pass through our servers in transit, because uploads and downloads are proxied through the app rather than exposing your cloud storage directly to other people in your organization. The file is held in memory only for the moment it takes to hand it to your storage provider, and is never written to our disk or our database. If you disconnect a storage account, your files stay exactly where they are — in your account, untouched.

Removing an attachment from a task, or deleting a task or workspace, removes the files from FocusMemoonly. They stay in your storage account, where FocusMemo put them. If you separately choose to move them to your provider’s trash, they go to that provider’s own recycle bin or deleted-files area, where you can restore them for as long as that provider keeps deleted files. FocusMemo never permanently deletes a file from your account.

Our access to your storage is deliberately narrow, on every provider. On Dropbox, FocusMemo is an App folder application: Dropbox itself confines it to the single folder it creates for the app (usually Apps/FocusMemo) and nothing else in your Dropbox. On OneDrive we request only the Files.ReadWrite.AppFolder permission, which Microsoft confines the same way, to the folder it creates for the app (usually Apps/FocusMemo) and no other part of your OneDrive. Both providers name that folder themselves, so the exact name can differ in your account. On Google Drive we request only the drive.file scope, which grants access to files the app itself created and nothing else in your Drive.

Inviting people

When you invite someone by email, we keep their address only until the invitation is accepted, revoked, or expires.

Connected accounts

If you connect Google Drive, Dropbox, OneDrive, or Apple Calendar, we store the credentials needed to keep that connection working — OAuth tokens for Google, Dropbox and Microsoft, an app-specific password for Apple Calendar. All of them are encrypted at rest with AES-256-GCM, and none is ever returned by any part of the app after you save it. You can disconnect any of them at any time.

Apple Calendar sync is two-way: events you create in FocusMemo can be written to your calendar, and events from your calendar are read into the app. That sync is personal to you — no one else in your organization can see the connection or the calendars it reads.

Email

We send email only for things you asked for: password resets, a notice when your password changes, workspace invitations, and confirmations about feedback you submitted. These are delivered through Resend, our email provider, which necessarily receives the recipient address and the message content. We send no marketing email.

Cookies

FocusMemo sets cookies only to make the app work. Every one of them is ours — nothing here is set by anyone else, and none of them is used for analytics, for advertising, or to follow you to other sites. All of them are marked HttpOnly, which means no script running on the page can read them, and on the live site all of them are marked Secure.

Two are set the moment you open the site, and a third once you sign in:

• authjs.session-token — keeps you signed in. Lasts 30 days, extended each time you use the app. On the live site it is named __Secure-authjs.session-token.
• authjs.csrf-token — protects signing in and signing out against forged requests from other sites. Lasts until you close your browser. On the live site it is named __Host-authjs.csrf-token.
• authjs.callback-url — remembers which page to return you to after you sign in. Lasts until you close your browser. On the live site it is named __Secure-authjs.callback-url.

Three more exist only while you are doing the one thing each is for, and each is deleted as soon as that is finished:

• fm_2fa_pending — set only if you use two-factor authentication, to hold the moment between your password and your code. Lasts 5 minutes.
• storage_oauth_state — set only while you are connecting Google Drive, Dropbox, or OneDrive, so we can confirm the provider’s reply belongs to a connection you started. Lasts 10 minutes.
• storage_oauth_pkce — set only while you are connecting OneDrive, and holds a one-time secret proving that connection is yours. Lasts 10 minutes.

Your theme and colour scheme are not kept in a cookie — they are saved to your account, so they follow you to whichever browser you sign in from. Two small things are kept in your browser’s own storage rather than in a cookie: a marker that you entered focus mode, cleared when you leave it, and the time of your last calendar refresh. Neither identifies you, and neither is sent anywhere.

Who can see your data

Your work is visible to people in your own organization according to rules the app enforces on the server, not merely in the interface. Some things are private even from your organization’s owner:

• Inbox tasks are visible only to the person who created them — including to an owner.
• Personal reminders belong to one person. Every reminder request is scoped to its owner, and answers “not found” to anyone else, so their existence is never revealed.
• Private calendar events — events not shared with a workspace — are visible only to their creator. A shared event can be seen by teammates but edited only by the person who made it.
• Your connected calendar account is yours alone; no one else can see it or its calendars.

Security

Passwords are hashed with bcrypt. Every third-party credential is encrypted at rest with AES-256-GCM. Sensitive endpoints are rate-limited. Optional two-factor authentication is available on your account, and its secret is encrypted too. No system is perfectly secure, and we will tell you promptly if we become aware of a breach affecting your data.

Keeping and deleting your data

Archiving is the app’s default for removing things, so an archived task, workspace, or client is hidden but recoverable until it is permanently deleted from the Archive. We keep your account data for as long as your account exists. Write to us at the address below to delete your account, and we will remove your account and your organization’s data from our systems. Files in your own Google Drive, Dropbox or OneDrive are not ours to delete — they remain in your account.

Children

FocusMemo is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If this policy changes materially we will update the date at the top and notify account holders by email.

Contact

Questions about this policy, or about your data: support@focusmemo.com